[Date Prev][Date Next] [Chronological] [Thread] [Top]

(ITS#7313) [PATCH 2/5] MozNSS: store certificate object instead of nickname in ctx

Full_Name: Jan Vcelak
Version: git master
OS: Linux
URL: http://jvcelak.fedorapeople.org/openldap-patches/jvcelak-120622-0002-MozNSS-store-certificate-object-instead-of-nickname-.patch
Submission from: (NULL) (209.132.186.34)


PEM certificates should not be referenced by nicknames, because the nicknames
are derived from basename of the cerificate file and in general are not
easy-predictable.

The code of Mozilla NSS backend depends on some aspects of PEM module and tries
to guess the nicknames correctly. In some cases the guessing is wrong.

This patch changes this approach and the PEM certificates are no longer
referenced by nicknames. DER value of the certificate is extracted when the PEM
file is loaded into the database and this DER value is then used to retrieve the
certificate object. When certificate database is used (not PEM), certificates
are retrieved using nickname as before.	

The retrieved certificate objects (and associated private keys) are now stored
directly in the tlsm_ctx structure and the nickname (certname) disappears.

The changes are quite broad, but the code was simplified on many places.

This approach was recommended by Mozilla NSS developers and was recently
implemented for example in CURL.

Patch could not upload to OpenLDAP FTP server due to "No space left on device.
Therefore I have uploaded the patch to fedorapeople.org. The patch is also
available in 'moznss' branch of git://github.com/fcelda/openldap.git
repository.


The attached file is derived from OpenLDAP Software. All of the modifications to
OpenLDAP Software represented in the following patch(es) were developed by Red
Hat. Red Hat has not assigned rights and/or interest in this work to any party.
I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under
the following terms.

Red Hat hereby place the following modifications to OpenLDAP Software (and only
these modifications) into the public domain. Hence, these modifications may be
freely used and/or redistributed for any purpose with or without attribution
and/or other notice.